Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,513All CVEsplus 18,890 rejected
- 418Last 24 hours3,032 in the last 7 days
- 17,430Last 30 days1,599 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 243 | 1,008 | 2,518 | 19 | 0 | 3,788 | 11,964 |
| 2025 | 262 | 703 | 2,470 | 15 | 0 | 3,450 | 8,176 |
| 2024 | 200 | 565 | 2,745 | 14 | 0 | 3,524 | 4,726 |
| 2023 | 66 | 191 | 613 | 9 | 0 | 879 | 1,202 |
| 2022 | 14 | 62 | 92 | 1 | 0 | 169 | 323 |
| 2021 | 6 | 31 | 117 | 0 | 0 | 154 | 154 |
| Title | ||
|---|---|---|
| CVE-2026-104799 | Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parametersrnlab · Mobile builder | High8.8 |
| CVE-2026-97397 | Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffereasywpstuff · Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance | High7.2 |
| CVE-2026-115498 | Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Fieldwingerspeed · Slim Jetpack | High7.2 |
| CVE-2026-120554 | Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Savecarazo · Import and export users and customers | High8.8 |
| CVE-2026-93900 | Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeselliotvs · Simple CAPTCHA with Cloudflare Turnstile | Medium6.4 |
| CVE-2026-76124 | BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback EndpointBuddyBoss · BuddyBoss App | High8.8 |
| CVE-2026-120578 | AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parametermigkapa · AI Alt Text Generator | Medium5.3 |
| CVE-2026-120538 | Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capturesmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | High8.1 |
| CVE-2026-120577 | FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameterwpmanageninja · FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | High8.1 |
| CVE-2026-120575 | Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Nametigroumeow · Photo Engine (Media Organizer & Lightroom) | Medium6.4 |
| CVE-2026-120574 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeoversurecart · SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | High8.1 |
| CVE-2026-120534 | Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field TypeACF Extended · Advanced Custom Fields: Extended PRO | Critical9.8 |
| CVE-2026-120563 | WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Fieldamirhelzer · WPML Multilingual & Multicurrency for WooCommerce | Medium4.9 |
| CVE-2026-120561 | JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modificationjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.3 |
| CVE-2026-120559 | Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversalsatindersingh · Contact Form Extender for Divi – Submissions DB & Extra Fields | High7.5 |
| CVE-2026-120524 | News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Actionblazethemes · News Kit Addons For Elementor | Medium6.4 |
| CVE-2026-120558 | Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameterzorem · Advanced Shipment Tracking for WooCommerce | High7.2 |
| CVE-2026-120552 | SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()tigroumeow · SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress | Medium6.4 |
| CVE-2026-120551 | WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parametersaresit · WP Compress – Instant Performance & Speed Optimization | Medium5.3 |
| CVE-2026-120544 | Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Routekodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning | Medium4.3 |
| CVE-2026-120518 | BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handlerkalengi · BuddyPress XProfile Custom Image Field | Critical9.1 |
| CVE-2026-111464 | WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Responseemrevona · WP Fastest Cache – WordPress Cache Plugin | Medium5.9 |
| CVE-2026-86596 | s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameterclavaque · s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | Critical9.8 |
| CVE-2026-102435 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Fieldthemefic · Ultra Addons for Contact Form 7 | Critical9.8 |
| CVE-2026-15272 | Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' ParameterShamalli · Web 2.0 Directory plugin for WordPress | Medium6.5 |
| CVE-2026-104926 | WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' ParameterThemeHigh · WooCommerce Extra Product Options Pro | Medium6.1 |
| CVE-2026-109231 | Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Changevendidero · Germanized for WooCommerce | Medium4.3 |
| CVE-2026-107711 | FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpointwppool · FlexStock – Product Stock Sync with Google Sheets for WooCommerce | Medium6.4 |
| CVE-2026-120114 | Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpointqriouslad · Debug Log Manager – Conveniently Monitor and Inspect Errors | High7.2 |
| CVE-2026-100151 | Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameterkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | Medium6.1 |
| CVE-2026-109197 | WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameterwpdirectorykit · WP Directory Kit | High7.5 |
| CVE-2026-96554 | BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group NameBoss Media · BuddyBoss Platform | Medium6.4 |
| CVE-2026-76010 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversalsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | High8.8 |
| CVE-2026-116752 | GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injectionpaoltaia · GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | Medium6.4 |
| CVE-2026-101325 | Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parametercontrid · Newsletters | Medium5.3 |
| CVE-2026-110530 | FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Contentradgeek · FeedWordPress | High7.2 |
| CVE-2026-120075 | WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scriptingmelapress · WP Activity Log | High7.2 |
| CVE-2026-103882 | Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameteracadlix · Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress | Critical9.1 |
| CVE-2026-119160 | Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter blockshapedplugin · Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | Medium6.4 |
| CVE-2026-109367 | All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parametersmub · All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | Medium5.3 |
| CVE-2026-118235 | SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_datawpazleen · SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications | Critical9.8 |
| CVE-2026-103915 | Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parametermelograno · Booking for Appointments and Events Calendar – Amelia | Medium5.3 |
| CVE-2026-120070 | User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameterwedevs · User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | High8.8 |
| CVE-2026-103898 | Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callbackroxnor · Wp Social Login and Register Social Counter | High8.1 |
| CVE-2026-111070 | Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`pluginever · Content Pilot – Autoblogging & Affiliate Marketing Suite | Medium5.4 |
| CVE-2026-107759 | WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mailwpo365 · WPO365 | MICROSOFT 365 GRAPH MAILER | High7.2 |
| CVE-2026-116512 | Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injectionwedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | Critical9.8 |
| CVE-2026-103997 | Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScriptdavidanderson · Redux Framework | Medium6.5 |
| CVE-2025-11455 | Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacementtigroumeow · Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF | Medium4.3 |
| CVE-2025-9462 | WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parametertobias_conrad · WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | Medium6.5 |